2496 matches found
CVE-2024-5753 Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna
vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as pgreadfile. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like /etc/passwd, by exploiting the exposed SQL...
Vanna Information Disclosure Vulnerability
Vanna is a personalized AI SQL agent from Vanna. An information disclosure vulnerability exists in v0.3.4 of vanna, which stems from the vulnerability of certain file-related functions to SQL injection attacks. An unauthenticated, remote attacker exploiting this vulnerability could read arbitrary...
CVE-2024-5827
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
CVE-2024-5827 Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
CVE-2024-5827 Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
CVE-2024-5827
Vanna v0.3.4 is affected by an SQL injection in the DuckDB integration exposed through its Flask Web APIs. The vulnerability allows attackers to inject malicious SQL training data and craft queries that can write arbitrary files to the file system (e.g., backdoor.php with contents ), potentially ...
MAL-2024-2385 Malicious code in flux_dev_tools.server.flask (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in flux_dev_tools.server.flask (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in flask-angular (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2375 Malicious code in flask-angular (npm)
--- -= Per source details. Do not edit below this line.=-...
OPENSUSE-SU-2024:11206-1 python36-Flask-Cors-3.0.10-1.3 on GA media
These are all security issues fixed in the python36-Flask-Cors-3.0.10-1.3 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:12923-1 python310-Flask-2.2.5-1.1 on GA media
These are all security issues fixed in the python310-Flask-2.2.5-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:13563-1 python310-Flask-Security-Too-5.3.3-1.1 on GA media
These are all security issues fixed in the python310-Flask-Security-Too-5.3.3-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:13561-1 python310-Flask-Security-Too-5.3.2-3.1 on GA media
These are all security issues fixed in the python310-Flask-Security-Too-5.3.2-3.1 package on the GA media of openSUSE Tumbleweed...
OESA-2024-1713 python-Flask-Cors security update
A Flask extension for handling Cross Origin Resource Sharing CORS, making cross-origin AJAX possible. Security Fixes: corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted...
Authentication Bypass / Remote Code Execution (RCE)
dtale is vulnerable to Authentication Bypass / Remote Code Execution RCE. The vulnerability is due to improper input validation and the presence of a hardcoded SECRETKEY in the Flask configuration, allowing attackers to forge a session cookie. Additionally, there is improper validation of custom...
D-Tale Input Validation Error Vulnerability
Man Group D-Tale is a pandas data structure visualization tool from Man Group, Inc. An input validation error vulnerability exists in D-Tale, which stems from a hard-coded SECRETKEY in the flask configuration, which allows an attacker to forge a session cookie if authentication is enabled...
Ubuntu: Security Advisory (USN-6792-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
